CVE-2026-11452
MediumThe manipulation of the argument Password leads to command injection.
Published Jun 7, 2026 · Updated Jul 23, 2026 · Also known as EUVD-2026-34983, GHSA-5qf6-3rw8-7jgg
Key Facts
Routine patching- CVE-2026-11452 is a medium-severity vulnerability (CVSS 6.9 v4) affecting Gl-Mt3000 Firmware (Gl-Inet), GL-MT3000.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 1.7% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v4
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS (30-day exploit likelihood)
1.7%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-11452 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address this issue. The affected component should be upgraded. The vendor explains: " The current code escapes single quotes in the password parameter and handles it inside a shell single‑quote context. The payloads in the report, which rely on $() or backticks to trigger command substitution, are not executed under the current code path. We tested on a GL‑MT3000 device running firmware 4.8.1 using similar payloads, and no command‑execution marker file was created."
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Gl-Mt3000 FirmwareGl-Inet | See advisory | n/a |
| GL-MT3000 | See advisory | n/a |
Timeline
Publicly disclosed
Jun 7, 2026
Last updated
Jul 23, 2026
Weakness Type
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
References
- advisoryhttps://vuldb.com/vuln/368966
- advisoryhttps://vuldb.com/vuln/369067
- advisoryhttps://vuldb.com/vuln/369069
- advisoryhttps://vuldb.com/vuln/369070
- advisoryUSOM advisory
FAQ
Common Questions.
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5.
Affected: Gl-Mt3000 Firmware (Gl-Inet); GL-MT3000. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-11452 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo